1 Answer
1

The regulations are addressed to the "operator of a Web site or online service directed to children, or any operator that has actual knowledge that it is collecting or maintaining personal information from a child". If you have an enforced policy of banning those under 13, you gain "actual knowledge" of the status of the liar when yuo learn their age. The FTC addresses the lying child question in FAQ 14, saying

The Rule does not require operators to ask the age of visitors.
However, an operator of a general audience site or service that
chooses to screen its users for age in a neutral fashion may rely on
the age information its users enter, even if that age information is
not accurate. In some circumstances, this may mean that children are
able to register on a site or service in violation of the operator’s
Terms of Service. If, however, the operator later determines that a
particular user is a child under age 13, COPPA’s notice and parental
consent requirements will be triggered.

If a banned lying child claims to now be 13 but in fact is still not 13, the notice and consent requirements have been triggered and you can be (massively) punished. If the child is over 13, there will be no penalty, since you didn't violate the rule.

The rule does not include any standards for proving age, and you have to evaluate any such evidence at your own risk. Whatever proof you would require, that would (if it were reasonably related to proof of age) constitute personal information, and the regulations require you to "obtain verifiable parental consent prior to any collection, use, and/or disclosure of personal information from children". In other words, parental consent is necessary to get the information necessary (birth certificate for example) to establish that parental consent is not necessary. You are strictly liable for violating the rule if you actually know that a user is under 13, and you can't argue "But he showed me a birth certificate".

§312.5 gives details about what constitutes "verifiable parental consent". (c) Exceptions to prior parental consent says that you can obtain personal information for the purpose of obtaining parental consent (otherwise, you would never be able to ask for parental consent, since you can't ask "who are your parents"). (c)(6) allows "collecting a child's name and online contact information to... take precautions against liability", but that does not include e.g. collecting a child's birth certificate. In other words, the only apparently safe course of action in case you have obtained actual knowledge that a user is a child is to require parental consent.

If all you learned was that the user was under 13, but you didn't learn their actual age, then for all you know, they might have been 12 years and 364 days, so by the next day, you could argue that you no longer have actual knowledge that they're under 13. That logic doesn't sound right, but I don't see how the law forbids it.
– Nate EldredgeAug 24 '18 at 0:10

I guess the point is that "actual knowledge" is not the same as "provable certainty". But then what does "actual knowledge" mean?
– Nate EldredgeAug 24 '18 at 0:13

From what I can tell, the courts have not weighed in on the matter, so we only have the FTC FAQ to go on, in order to guess how they will interpret such a case. However, "ability to imagine otherwise" does not sweep away actual knowledge.
– user6726Aug 24 '18 at 0:25

Isn't the quote language saying the opposite of what you're saying? "An operator ... may rely on the age information its users enter, even if that age information is not accurate." So if the child claims to be over 13, how can the operator be both entitled to rely on that information but also subject to massive punishment?
– bdb484Aug 24 '18 at 0:33

It's the later part, about when you gain actual knowledge and thus ban the child, that causes problems. There's no "un-know" provision in the law.
– user6726Aug 24 '18 at 1:46

Law Stack Exchange is for educational purposes only and is not a substitute for individualized advice from a qualified legal practitioner. Communications on Law Stack Exchange are not privileged communications and do not create an attorney-client relationship.